feat(engine): corroborate privilege escalation on the foothold entry (JEF-314)

[thejefflarson]

Summary

• Closes JEF-314 — closes a Falco-parity gap: Falco fires critical on setuid→root, but the engine's flat corroborates(PrivilegeChange, _) relation stays non-corroborating everywhere (ADR-0011: legit entrypoints/inits escalate to root on ordinary pods constantly, so it's model evidence only).
• Adds a new entry-scoped corroboration shape, privilege_escalation_on_foothold, mirroring the existing JEF-319 cross_tenant_lateral pattern: a PrivilegeChange non-root→root corroborates a PrivilegeEscalation-tactic objective (T1611 Escape to Host / T1098.006 RBAC self-escalation, and any future T1548-tactic technique) only when the entry is the proven internet-facing foothold (EntryContext.is_foothold).
• Wired into corroborated_for alongside cross_tenant_lateral. Shadow-gated per ADR-0014: this only sets corroborated; it never actuates and touches no default/enable config.

How I identified the gate points

• The internet-facing-entry gate is EntryContext.is_foothold, already resolved once per entry in prove_with (engine/src/engine/reason/proof/mod.rs) from entry_foothold(graph, entry).is_some() — the same flag the existing cross_tenant_lateral (JEF-319) shape gates on, so the new shape reuses it rather than adding a new notion of "entry."
• The PrivilegeChange { from_uid, to_uid } non-root→root condition is from_uid != 0 && to_uid == 0, matching the wire type in behavior/src/lib.rs.
• Tactic::PrivilegeEscalation (T1611 ESCAPE_TO_HOST, T1098.006 RBAC_ESCALATION) already exists in engine/src/engine/graph/attack.rs; the new shape gates on attack.tactic == Tactic::PrivilegeEscalation, the stable per-tactic key the rest of corroborates already uses.

Tests (both ways, engine/src/engine/reason/proof/corroborate_privesc_tests.rs)

• root_escalation_on_the_foothold_entry_corroborates_priv_esc — root escalation on the proven foothold entry corroborates the PrivilegeEscalation chain (end-to-end via corroborated_for and directly via the predicate).
• root_escalation_on_a_non_foothold_entry_does_not_corroborate — the SAME escalation on an ordinary (non-foothold) pod does NOT corroborate.
• Plus two regression guards: a non-root-landing privilege change on the foothold doesn't corroborate, and a root escalation on the foothold doesn't blanket-corroborate an unrelated (CredentialAccess) objective.

Test plan

• cargo fmt
• cargo clippy --all-targets -- -D warnings — clean
• cargo nextest run --workspace (the CI runner; cargo test alone races on shared env vars in run_loop::tests per that file's own doc comment) — 959 passed, 0 failed, 2 ignored (pre-existing network-only ignores)
• soundcheck:pr-review self-review — no Critical/High findings (pure detection-policy logic, shadow-gated, no user input/injection/auth surface)
• /simplify self-review (Agent tool unavailable in this context) — clean, no changes needed
• No source file exceeds 1,000 lines (corroborate.rs 237, corroborate_privesc_tests.rs 133)

🤖 Generated with Claude Code

https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP